Code backdoor in simple_captcha2

CRITICAL 9.8CVE-2019-14282 · GHSA-wg6j-r28m-7293 · Published 26/07/2019 · updated 17/06/2026

In short

CVE-2019-14282 is a CRITICAL (CVSS 9.8) vulnerability affecting simple_captcha2, simple captcha2 (simple captcha2 project).
Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 87.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
simple_captcha2 RubyGems	`= 0.2.3`	No fix yet
simple captcha2 simple_captcha2_project	`= 0.2.3`	No fix yet

The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.

NVD description

The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.